awatertrevi/infisical
1
0
Fork 0
mirror of https://github.com/awatertrevi/infisical.git synced 2026-10-08 08:27:53 +00:00
Code Issues Packages Projects Releases Wiki Activity

Add signature type enum

Browse Source
This commit is contained in:
Carlos Monastyrski
2025-10-17 16:09:58 -03:00
parent e195afba11
commit ebac93e500
2 changed files with 11 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files
backend/src/services/certificate-authority/internal/internal-certificate-authority-service.ts
+6 -9
View File
@@ -33,6 +33,7 @@ import {
CertKeyAlgorithm, CertKeyAlgorithm,
CertKeyUsage, CertKeyUsage,
CertSignatureAlgorithm, CertSignatureAlgorithm,
CertSignatureType,
CertStatus, CertStatus,
TAltNameMapping TAltNameMapping
} from "../../certificate/certificate-types"; } from "../../certificate/certificate-types";
@@ -1663,19 +1664,15 @@ export const internalCertificateAuthorityServiceFactory = ({
const caKeyAlgorithm = ca.internalCa.keyAlgorithm; const caKeyAlgorithm = ca.internalCa.keyAlgorithm;
const requestedKeyType = signatureAlgorithm.split("-")[0]; // Get the first part (RSA, ECDSA) const requestedKeyType = signatureAlgorithm.split("-")[0]; // Get the first part (RSA, ECDSA)
const isRsaCa = caKeyAlgorithm.startsWith(CertKeyAlgorithm.RSA_2048.split("_")[0]); const isRsaCa = caKeyAlgorithm.startsWith(CertSignatureType.RSA);
const isEcdsaCa = caKeyAlgorithm.startsWith(CertKeyAlgorithm.ECDSA_P256.split("_")[0]); const isEcdsaCa = caKeyAlgorithm.startsWith(CertSignatureType.ECDSA);
if ( if (
(requestedKeyType === CertSignatureAlgorithm.RSA_SHA256.split("-")[0] && !isRsaCa) || (requestedKeyType === CertSignatureType.RSA && !isRsaCa) ||
(requestedKeyType === CertSignatureAlgorithm.ECDSA_SHA256.split("-")[0] && !isEcdsaCa) (requestedKeyType === CertSignatureType.ECDSA && !isEcdsaCa)
) { ) {
// eslint-disable-next-line no-nested-ternary // eslint-disable-next-line no-nested-ternary
const supportedType = isRsaCa const supportedType = isRsaCa ? CertSignatureType.RSA : isEcdsaCa ? CertSignatureType.ECDSA : "unknown";
? CertSignatureAlgorithm.RSA_SHA256.split("-")[0]
: isEcdsaCa
? CertSignatureAlgorithm.ECDSA_SHA256.split("-")[0]
: "unknown";
throw new BadRequestError({ throw new BadRequestError({
message: `Requested signature algorithm ${signatureAlgorithm} is not compatible with CA key algorithm ${caKeyAlgorithm}. CA can only sign with ${supportedType}-based signature algorithms.` message: `Requested signature algorithm ${signatureAlgorithm} is not compatible with CA key algorithm ${caKeyAlgorithm}. CA can only sign with ${supportedType}-based signature algorithms.`
}); });
backend/src/services/certificate/certificate-types.ts
+5
View File
@@ -51,6 +51,11 @@ export enum CertExtendedKeyUsage {
OCSP_SIGNING = "ocspSigning" OCSP_SIGNING = "ocspSigning"
} }
export enum CertSignatureType {
RSA = "RSA",
ECDSA = "ECDSA"
}
export const CertExtendedKeyUsageOIDToName: Record<string, CertExtendedKeyUsage> = { export const CertExtendedKeyUsageOIDToName: Record<string, CertExtendedKeyUsage> = {
[x509.ExtendedKeyUsage.clientAuth]: CertExtendedKeyUsage.CLIENT_AUTH, [x509.ExtendedKeyUsage.clientAuth]: CertExtendedKeyUsage.CLIENT_AUTH,
[x509.ExtendedKeyUsage.serverAuth]: CertExtendedKeyUsage.SERVER_AUTH, [x509.ExtendedKeyUsage.serverAuth]: CertExtendedKeyUsage.SERVER_AUTH,